chore: propagate changes from main into development - #1320

Closed

github-actions[bot] wants to merge 17 commits into

developmentfrom

main

Commits on Sep 9, 2026

test: add fixme e2e specs for privileged-route authz and removal of public registration
Wikid82
committed
7e816a5
fix(security): tighten authorization checks on privileged API routes
Wikid82
committed
6db813b
fix(security): apply deny-by-default authorization on management API subroutes
Wikid82
committed
8f5b1bf
fix(security): reduce unauthenticated API surface
Wikid82
committed
8a1f5df
docs: document management-API authorization model and account-creation flow
Wikid82
committed
8eb20bd
refactor(security): tidy authorization hardening and add self-service guard test
Wikid82
committed
337f53e
test: enable e2e coverage for privileged-route authorization and registration removal
Wikid82
committed
b58bd52
docs: add qa security report for management-API authorization hardening
Wikid82
committed
c8acaf1
docs: record management-API authorization hardening plan
Wikid82
committed
887194e
fix(ci): repair integration test bootstrap after auth surface reduction
Wikid82
committed
9445600
fix(deps): update gRPC version to 1.83.2
Wikid82
committed
01a6a5c
chore(docker): sync toolchain pin to development's gRPC 1.83.2 recipe
Wikid82
committed
b18d4af
fix(security): enforce admin authorization on management API + retire public registration (#1316)
Wikid82
authored
8168732
chore(main): release 0.40.2
github-actions[bot]
authored
8583987
chore(main): release 0.40.2 (#1319)
Wikid82
authored
cb7bdbe
chore: re-anchor go/log-injection CodeQL suppression after route-group split
Wikid82
committed
ca16934
chore: re-anchor go/log-injection CodeQL suppression after route-group split (#1321)
Wikid82
authored
bda03ce

Navigation Menu

Uh oh!

chore: propagate changes from main into development - #1320

chore: propagate changes from main into development#1320
github-actions[bot] wants to merge 17 commits into
developmentfrom
main

Commits on Sep 9, 2026

test: add fixme e2e specs for privileged-route authz and removal of public registration

fix(security): tighten authorization checks on privileged API routes

fix(security): apply deny-by-default authorization on management API subroutes

fix(security): reduce unauthenticated API surface

docs: document management-API authorization model and account-creation flow

refactor(security): tidy authorization hardening and add self-service guard test

test: enable e2e coverage for privileged-route authorization and registration removal

docs: add qa security report for management-API authorization hardening

docs: record management-API authorization hardening plan

fix(ci): repair integration test bootstrap after auth surface reduction

fix(deps): update gRPC version to 1.83.2

chore(docker): sync toolchain pin to development's gRPC 1.83.2 recipe

fix(security): enforce admin authorization on management API + retire public registration (#1316)

chore(main): release 0.40.2

chore(main): release 0.40.2 (#1319)

chore: re-anchor go/log-injection CodeQL suppression after route-group split

chore: re-anchor go/log-injection CodeQL suppression after route-group split (#1321)